Lenovo ThinkPlus FU100 fingerprint USB stick is just a plain SD card
Security researcher Xusheng Li reported that Lenovo’s ThinkPlus FU100, marketed as an AES‑256 encrypted device, is in fact a plain SD card inside a case. The fingerprint reader only enables USB access; no data on the card is encrypted.
Key points
- Lenovo ThinkPlus FU100 marketed as AES‑256 encrypted but is just a plain SD card
- AI‑assisted reverse engineering found backdoor accounts and hardcoded keys in other secure USB devices
- Lenovo issued fixes requiring device return or on‑site firmware upgrade, advising data backup and wipe
Li’s AI‑assisted follow‑up uncovered backdoor accounts and hardcoded keys in other supposedly secure USB products. The analysis also revealed that Lenovo’s TSD303 SSD sent the correct password over USB in plain text, allowing easy capture. Lenovo issued fixes for the FU100, FU200, TU800 and TSD303 drives, requiring owners to call a China service line and either ship devices back for replacement or receive an on‑site firmware upgrade. The company advises backing up data first and wiping the drive before sending it in.
The reverse‑engineering work used OpenAI’s Codex to break several vendors’ protection schemes: Netac’s tool took about seven minutes, KakaSoft’s 26 minutes, and Nexcopy’s 10 minutes. SecZure’s YutianDun contained two hidden backdoor accounts with simple passwords. Li noted that no warnings were issued to affected vendors and that client‑side validation is never secure.
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products
Tom's Hardware · 1 November 2026
Loading the full article…
This text was published by Tom's Hardware and written by Shane Downing. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Hardware & Compute
All →- Open-source USB tool unlocks Nvidia’s AI limiter on Windows GPUs · 1 src
- Oracle unveils Acceleron updates for AI workloads · 1 src
- Google's Project Suncatcher satellite returns first AI-generated haiku from orbit using Gemma 4 on TPU · 12 src
- Amazon plans to sell Trainium AI chips externally starting late 2027 · 4 src
- Google Cloud rolls out 80,000-Rubin GPU site · 1 src
Comments
via GitHub Discussions